1/*
2 * (C) 2005-2011 by Pablo Neira Ayuso <pablo@netfilter.org>
3 *
4 * This program is free software; you can redistribute it and/or modify it
5 * under the terms of the GNU General Public License as published by
6 * the Free Software Foundation; either version 2 of the License, or
7 * (at your option) any later version.
8 */
9
10#ifndef _LIBNETFILTER_CONNTRACK_H_
11#define _LIBNETFILTER_CONNTRACK_H_
12
13#include <stdbool.h>
14#include <netinet/in.h>
15#include <libnfnetlink/linux_nfnetlink.h>
16#include <libnfnetlink/libnfnetlink.h>
17#include <libnetfilter_conntrack/linux_nfnetlink_conntrack.h>
18
19#ifdef __cplusplus
20extern "C" {
21#endif
22
23enum {
24	CONNTRACK = NFNL_SUBSYS_CTNETLINK,
25	EXPECT = NFNL_SUBSYS_CTNETLINK_EXP
26};
27
28/*
29 * Subscribe to all possible conntrack event groups. Use this
30 * flag in case that you want to catch up all the possible
31 * events. Do not use this flag for dumping or any other
32 * similar operation.
33 */
34#define NFCT_ALL_CT_GROUPS (NF_NETLINK_CONNTRACK_NEW|NF_NETLINK_CONNTRACK_UPDATE|NF_NETLINK_CONNTRACK_DESTROY)
35
36struct nfct_handle;
37
38/*
39 * [Open|close] a conntrack handler
40 */
41extern struct nfct_handle *nfct_open(uint8_t, unsigned);
42extern struct nfct_handle *nfct_open2(uint8_t, unsigned, int);
43extern struct nfct_handle *nfct_open_nfnl(struct nfnl_handle *nfnlh,
44					  uint8_t subsys_id,
45					  unsigned int subscriptions);
46extern struct nfct_handle *nfct_open_nfnl2(struct nfnl_handle *nfnlh,
47					  uint8_t subsys_id,
48					  unsigned int subscriptions,
49					  bool bind);
50extern int nfct_close(struct nfct_handle *cth);
51extern int nfct_close2(struct nfct_handle *cth, bool keep_fd);
52
53extern int nfct_fd(struct nfct_handle *cth);
54extern const struct nfnl_handle *nfct_nfnlh(struct nfct_handle *cth);
55
56/*
57 * NEW libnetfilter_conntrack API
58 */
59
60/* high level API */
61
62#include <sys/types.h>
63
64/* conntrack object */
65struct nf_conntrack;
66
67/* conntrack attributes */
68enum nf_conntrack_attr {
69	ATTR_ORIG_IPV4_SRC = 0,			/* u32 bits */
70	ATTR_IPV4_SRC = ATTR_ORIG_IPV4_SRC,	/* alias */
71	ATTR_ORIG_IPV4_DST,			/* u32 bits */
72	ATTR_IPV4_DST = ATTR_ORIG_IPV4_DST,	/* alias */
73	ATTR_REPL_IPV4_SRC,			/* u32 bits */
74	ATTR_REPL_IPV4_DST,			/* u32 bits */
75	ATTR_ORIG_IPV6_SRC = 4,			/* u128 bits */
76	ATTR_IPV6_SRC = ATTR_ORIG_IPV6_SRC,	/* alias */
77	ATTR_ORIG_IPV6_DST,			/* u128 bits */
78	ATTR_IPV6_DST = ATTR_ORIG_IPV6_DST,	/* alias */
79	ATTR_REPL_IPV6_SRC,			/* u128 bits */
80	ATTR_REPL_IPV6_DST,			/* u128 bits */
81	ATTR_ORIG_PORT_SRC = 8,			/* u16 bits */
82	ATTR_PORT_SRC = ATTR_ORIG_PORT_SRC,	/* alias */
83	ATTR_ORIG_PORT_DST,			/* u16 bits */
84	ATTR_PORT_DST = ATTR_ORIG_PORT_DST,	/* alias */
85	ATTR_REPL_PORT_SRC,			/* u16 bits */
86	ATTR_REPL_PORT_DST,			/* u16 bits */
87	ATTR_ICMP_TYPE = 12,			/* u8 bits */
88	ATTR_ICMP_CODE,				/* u8 bits */
89	ATTR_ICMP_ID,				/* u16 bits */
90	ATTR_ORIG_L3PROTO,			/* u8 bits */
91	ATTR_L3PROTO = ATTR_ORIG_L3PROTO,	/* alias */
92	ATTR_REPL_L3PROTO = 16,			/* u8 bits */
93	ATTR_ORIG_L4PROTO,			/* u8 bits */
94	ATTR_L4PROTO = ATTR_ORIG_L4PROTO,	/* alias */
95	ATTR_REPL_L4PROTO,			/* u8 bits */
96	ATTR_TCP_STATE,				/* u8 bits */
97	ATTR_SNAT_IPV4 = 20,			/* u32 bits */
98	ATTR_DNAT_IPV4,				/* u32 bits */
99	ATTR_SNAT_PORT,				/* u16 bits */
100	ATTR_DNAT_PORT,				/* u16 bits */
101	ATTR_TIMEOUT = 24,			/* u32 bits */
102	ATTR_MARK,				/* u32 bits */
103	ATTR_ORIG_COUNTER_PACKETS,		/* u64 bits */
104	ATTR_REPL_COUNTER_PACKETS,		/* u64 bits */
105	ATTR_ORIG_COUNTER_BYTES = 28,		/* u64 bits */
106	ATTR_REPL_COUNTER_BYTES,		/* u64 bits */
107	ATTR_USE,				/* u32 bits */
108	ATTR_ID,				/* u32 bits */
109	ATTR_STATUS = 32,			/* u32 bits  */
110	ATTR_TCP_FLAGS_ORIG,			/* u8 bits */
111	ATTR_TCP_FLAGS_REPL,			/* u8 bits */
112	ATTR_TCP_MASK_ORIG,			/* u8 bits */
113	ATTR_TCP_MASK_REPL = 36,		/* u8 bits */
114	ATTR_MASTER_IPV4_SRC,			/* u32 bits */
115	ATTR_MASTER_IPV4_DST,			/* u32 bits */
116	ATTR_MASTER_IPV6_SRC,			/* u128 bits */
117	ATTR_MASTER_IPV6_DST = 40,		/* u128 bits */
118	ATTR_MASTER_PORT_SRC,			/* u16 bits */
119	ATTR_MASTER_PORT_DST,			/* u16 bits */
120	ATTR_MASTER_L3PROTO,			/* u8 bits */
121	ATTR_MASTER_L4PROTO = 44,		/* u8 bits */
122	ATTR_SECMARK,				/* u32 bits */
123	ATTR_ORIG_NAT_SEQ_CORRECTION_POS,	/* u32 bits */
124	ATTR_ORIG_NAT_SEQ_OFFSET_BEFORE,	/* u32 bits */
125	ATTR_ORIG_NAT_SEQ_OFFSET_AFTER = 48,	/* u32 bits */
126	ATTR_REPL_NAT_SEQ_CORRECTION_POS,	/* u32 bits */
127	ATTR_REPL_NAT_SEQ_OFFSET_BEFORE,	/* u32 bits */
128	ATTR_REPL_NAT_SEQ_OFFSET_AFTER,		/* u32 bits */
129	ATTR_SCTP_STATE = 52,			/* u8 bits */
130	ATTR_SCTP_VTAG_ORIG,			/* u32 bits */
131	ATTR_SCTP_VTAG_REPL,			/* u32 bits */
132	ATTR_HELPER_NAME,			/* string (30 bytes max) */
133	ATTR_DCCP_STATE = 56,			/* u8 bits */
134	ATTR_DCCP_ROLE,				/* u8 bits */
135	ATTR_DCCP_HANDSHAKE_SEQ,		/* u64 bits */
136	ATTR_TCP_WSCALE_ORIG,			/* u8 bits */
137	ATTR_TCP_WSCALE_REPL = 60,		/* u8 bits */
138	ATTR_ZONE,				/* u16 bits */
139	ATTR_SECCTX,				/* string */
140	ATTR_TIMESTAMP_START,			/* u64 bits, linux >= 2.6.38 */
141	ATTR_TIMESTAMP_STOP = 64,		/* u64 bits, linux >= 2.6.38 */
142	ATTR_HELPER_INFO,			/* variable length */
143	ATTR_CONNLABELS,			/* variable length */
144	ATTR_CONNLABELS_MASK,			/* variable length */
145	ATTR_ORIG_ZONE,				/* u16 bits */
146	ATTR_REPL_ZONE,				/* u16 bits */
147	ATTR_SNAT_IPV6,				/* u128 bits */
148	ATTR_DNAT_IPV6,				/* u128 bits */
149	ATTR_MAX
150};
151
152/* conntrack attribute groups */
153enum nf_conntrack_attr_grp {
154	ATTR_GRP_ORIG_IPV4 = 0,			/* struct nfct_attr_grp_ipv4 */
155	ATTR_GRP_REPL_IPV4,			/* struct nfct_attr_grp_ipv4 */
156	ATTR_GRP_ORIG_IPV6,			/* struct nfct_attr_grp_ipv6 */
157	ATTR_GRP_REPL_IPV6,			/* struct nfct_attr_grp_ipv6 */
158	ATTR_GRP_ORIG_PORT = 4,			/* struct nfct_attr_grp_port */
159	ATTR_GRP_REPL_PORT,			/* struct nfct_attr_grp_port */
160	ATTR_GRP_ICMP,				/* struct nfct_attr_grp_icmp */
161	ATTR_GRP_MASTER_IPV4,			/* struct nfct_attr_grp_ipv4 */
162	ATTR_GRP_MASTER_IPV6 = 8,		/* struct nfct_attr_grp_ipv6 */
163	ATTR_GRP_MASTER_PORT,			/* struct nfct_attr_grp_port */
164	ATTR_GRP_ORIG_COUNTERS,			/* struct nfct_attr_grp_ctrs */
165	ATTR_GRP_REPL_COUNTERS,			/* struct nfct_attr_grp_ctrs */
166	ATTR_GRP_ORIG_ADDR_SRC = 12,		/* union nfct_attr_grp_addr */
167	ATTR_GRP_ORIG_ADDR_DST,			/* union nfct_attr_grp_addr */
168	ATTR_GRP_REPL_ADDR_SRC,			/* union nfct_attr_grp_addr */
169	ATTR_GRP_REPL_ADDR_DST,			/* union nfct_attr_grp_addr */
170	ATTR_GRP_MAX
171};
172
173struct nfct_attr_grp_ipv4 {
174	uint32_t src, dst;
175};
176
177struct nfct_attr_grp_ipv6 {
178	uint32_t src[4], dst[4];
179};
180
181struct nfct_attr_grp_port {
182	uint16_t sport, dport;
183};
184
185struct nfct_attr_grp_icmp {
186	uint16_t id;
187	uint8_t code, type;
188};
189
190struct nfct_attr_grp_ctrs {
191	uint64_t packets;
192	uint64_t bytes;
193};
194
195union nfct_attr_grp_addr {
196	uint32_t ip;
197	uint32_t ip6[4];
198	uint32_t addr[4];
199};
200
201/* message type */
202enum nf_conntrack_msg_type {
203	NFCT_T_UNKNOWN = 0,
204
205	NFCT_T_NEW_BIT = 0,
206	NFCT_T_NEW = (1 << NFCT_T_NEW_BIT),
207
208	NFCT_T_UPDATE_BIT = 1,
209	NFCT_T_UPDATE = (1 << NFCT_T_UPDATE_BIT),
210
211	NFCT_T_DESTROY_BIT = 2,
212	NFCT_T_DESTROY = (1 << NFCT_T_DESTROY_BIT),
213
214	NFCT_T_ALL = NFCT_T_NEW | NFCT_T_UPDATE | NFCT_T_DESTROY,
215
216	NFCT_T_ERROR_BIT = 31,
217	NFCT_T_ERROR = (1 << NFCT_T_ERROR_BIT),
218};
219
220/* constructor / destructor */
221extern struct nf_conntrack *nfct_new(void);
222extern void nfct_destroy(struct nf_conntrack *ct);
223
224/* clone */
225struct nf_conntrack *nfct_clone(const struct nf_conntrack *ct);
226
227/* object size */
228extern __attribute__((deprecated)) size_t nfct_sizeof(const struct nf_conntrack *ct);
229
230/* maximum object size */
231extern __attribute__((deprecated)) size_t nfct_maxsize(void);
232
233/* set option */
234enum {
235	NFCT_SOPT_UNDO_SNAT,
236	NFCT_SOPT_UNDO_DNAT,
237	NFCT_SOPT_UNDO_SPAT,
238	NFCT_SOPT_UNDO_DPAT,
239	NFCT_SOPT_SETUP_ORIGINAL,
240	NFCT_SOPT_SETUP_REPLY,
241	__NFCT_SOPT_MAX,
242};
243#define NFCT_SOPT_MAX (__NFCT_SOPT_MAX - 1)
244
245/* get option */
246enum {
247	NFCT_GOPT_IS_SNAT,
248	NFCT_GOPT_IS_DNAT,
249	NFCT_GOPT_IS_SPAT,
250	NFCT_GOPT_IS_DPAT,
251	__NFCT_GOPT_MAX,
252};
253#define NFCT_GOPT_MAX (__NFCT_GOPT_MAX - 1)
254
255extern int nfct_setobjopt(struct nf_conntrack *ct, unsigned int option);
256extern int nfct_getobjopt(const struct nf_conntrack *ct, unsigned int option);
257
258/* register / unregister callback */
259
260extern int nfct_callback_register(struct nfct_handle *h,
261				  enum nf_conntrack_msg_type type,
262				  int (*cb)(enum nf_conntrack_msg_type type,
263				  	    struct nf_conntrack *ct,
264					    void *data),
265				  void *data);
266
267extern void nfct_callback_unregister(struct nfct_handle *h);
268
269/* register / unregister callback: extended version including netlink header */
270
271extern int nfct_callback_register2(struct nfct_handle *h,
272				   enum nf_conntrack_msg_type type,
273				   int (*cb)(const struct nlmsghdr *nlh,
274				   	     enum nf_conntrack_msg_type type,
275				  	     struct nf_conntrack *ct,
276					     void *data),
277				   void *data);
278
279extern void nfct_callback_unregister2(struct nfct_handle *h);
280
281/* callback verdict */
282enum {
283	NFCT_CB_FAILURE = -1,   /* failure */
284	NFCT_CB_STOP = 0,       /* stop the query */
285	NFCT_CB_CONTINUE = 1,   /* keep iterating through data */
286	NFCT_CB_STOLEN = 2,     /* like continue, but ct is not freed */
287};
288
289/* bitmask setter/getter */
290struct nfct_bitmask;
291
292struct nfct_bitmask *nfct_bitmask_new(unsigned int maxbit);
293struct nfct_bitmask *nfct_bitmask_clone(const struct nfct_bitmask *);
294unsigned int nfct_bitmask_maxbit(const struct nfct_bitmask *);
295
296void nfct_bitmask_set_bit(struct nfct_bitmask *, unsigned int bit);
297int nfct_bitmask_test_bit(const struct nfct_bitmask *, unsigned int bit);
298void nfct_bitmask_unset_bit(struct nfct_bitmask *, unsigned int bit);
299void nfct_bitmask_destroy(struct nfct_bitmask *);
300void nfct_bitmask_clear(struct nfct_bitmask *);
301bool nfct_bitmask_equal(const struct nfct_bitmask *, const struct nfct_bitmask *);
302
303/* connlabel name <-> bit translation mapping */
304struct nfct_labelmap;
305
306const char *nfct_labels_get_path(void);
307struct nfct_labelmap *nfct_labelmap_new(const char *mapfile);
308void nfct_labelmap_destroy(struct nfct_labelmap *map);
309const char *nfct_labelmap_get_name(struct nfct_labelmap *m, unsigned int bit);
310int nfct_labelmap_get_bit(struct nfct_labelmap *m, const char *name);
311
312/* setter */
313extern void nfct_set_attr(struct nf_conntrack *ct,
314			  const enum nf_conntrack_attr type,
315			  const void *value);
316
317extern void nfct_set_attr_u8(struct nf_conntrack *ct,
318			     const enum nf_conntrack_attr type,
319			     uint8_t value);
320
321extern void nfct_set_attr_u16(struct nf_conntrack *ct,
322			      const enum nf_conntrack_attr type,
323			      uint16_t value);
324
325extern void nfct_set_attr_u32(struct nf_conntrack *ct,
326			      const enum nf_conntrack_attr type,
327			      uint32_t value);
328
329extern void nfct_set_attr_u64(struct nf_conntrack *ct,
330			      const enum nf_conntrack_attr type,
331			      uint64_t value);
332
333extern void nfct_set_attr_l(struct nf_conntrack *ct,
334			    const enum nf_conntrack_attr type,
335			    const void *value,
336			    size_t len);
337
338/* getter */
339extern const void *nfct_get_attr(const struct nf_conntrack *ct,
340				 const enum nf_conntrack_attr type);
341
342extern uint8_t nfct_get_attr_u8(const struct nf_conntrack *ct,
343				 const enum nf_conntrack_attr type);
344
345extern uint16_t nfct_get_attr_u16(const struct nf_conntrack *ct,
346				   const enum nf_conntrack_attr type);
347
348extern uint32_t nfct_get_attr_u32(const struct nf_conntrack *ct,
349				   const enum nf_conntrack_attr type);
350
351extern uint64_t nfct_get_attr_u64(const struct nf_conntrack *ct,
352				   const enum nf_conntrack_attr type);
353
354/* checker */
355extern int nfct_attr_is_set(const struct nf_conntrack *ct,
356			    const enum nf_conntrack_attr type);
357
358extern int nfct_attr_is_set_array(const struct nf_conntrack *ct,
359				  const enum nf_conntrack_attr *type_array,
360				  int size);
361
362/* unsetter */
363extern int nfct_attr_unset(struct nf_conntrack *ct,
364			   const enum nf_conntrack_attr type);
365
366/* group setter */
367extern void nfct_set_attr_grp(struct nf_conntrack *ct,
368			      const enum nf_conntrack_attr_grp type,
369			      const void *value);
370/* group getter */
371extern int nfct_get_attr_grp(const struct nf_conntrack *ct,
372			     const enum nf_conntrack_attr_grp type,
373			     void *data);
374
375/* group checker */
376extern int nfct_attr_grp_is_set(const struct nf_conntrack *ct,
377				const enum nf_conntrack_attr_grp type);
378
379/* unsetter */
380extern int nfct_attr_grp_unset(struct nf_conntrack *ct,
381			       const enum nf_conntrack_attr_grp type);
382
383/* print */
384
385/* output type */
386enum {
387	NFCT_O_PLAIN,
388	NFCT_O_DEFAULT = NFCT_O_PLAIN,
389	NFCT_O_XML,
390	NFCT_O_MAX
391};
392
393/* output flags */
394enum {
395	NFCT_OF_SHOW_LAYER3_BIT = 0,
396	NFCT_OF_SHOW_LAYER3 = (1 << NFCT_OF_SHOW_LAYER3_BIT),
397
398	NFCT_OF_TIME_BIT = 1,
399	NFCT_OF_TIME = (1 << NFCT_OF_TIME_BIT),
400
401	NFCT_OF_ID_BIT = 2,
402	NFCT_OF_ID = (1 << NFCT_OF_ID_BIT),
403
404	NFCT_OF_TIMESTAMP_BIT = 3,
405	NFCT_OF_TIMESTAMP = (1 << NFCT_OF_TIMESTAMP_BIT),
406};
407
408extern int nfct_snprintf(char *buf,
409			 unsigned int size,
410			 const struct nf_conntrack *ct,
411			 const unsigned int msg_type,
412			 const unsigned int out_type,
413			 const unsigned int out_flags);
414
415extern int nfct_snprintf_labels(char *buf,
416				unsigned int size,
417				const struct nf_conntrack *ct,
418				const unsigned int msg_type,
419				const unsigned int out_type,
420				const unsigned int out_flags,
421				struct nfct_labelmap *map);
422
423/* comparison */
424extern int nfct_compare(const struct nf_conntrack *ct1,
425			const struct nf_conntrack *ct2);
426
427enum {
428	NFCT_CMP_ALL = 0,
429	NFCT_CMP_ORIG = (1 << 0),
430	NFCT_CMP_REPL = (1 << 1),
431	NFCT_CMP_TIMEOUT_EQ = (1 << 2),
432	NFCT_CMP_TIMEOUT_GT = (1 << 3),
433	NFCT_CMP_TIMEOUT_GE = (NFCT_CMP_TIMEOUT_EQ | NFCT_CMP_TIMEOUT_GT),
434	NFCT_CMP_TIMEOUT_LT = (1 << 4),
435	NFCT_CMP_TIMEOUT_LE = (NFCT_CMP_TIMEOUT_EQ | NFCT_CMP_TIMEOUT_LT),
436	NFCT_CMP_MASK = (1 << 5),
437	NFCT_CMP_STRICT = (1 << 6),
438};
439
440extern int nfct_cmp(const struct nf_conntrack *ct1,
441		    const struct nf_conntrack *ct2,
442		    unsigned int flags);
443
444
445/* query */
446enum nf_conntrack_query {
447	NFCT_Q_CREATE,
448	NFCT_Q_UPDATE,
449	NFCT_Q_DESTROY,
450	NFCT_Q_GET,
451	NFCT_Q_FLUSH,
452	NFCT_Q_DUMP,
453	NFCT_Q_DUMP_RESET,
454	NFCT_Q_CREATE_UPDATE,
455	NFCT_Q_DUMP_FILTER,
456	NFCT_Q_DUMP_FILTER_RESET,
457};
458
459extern int nfct_query(struct nfct_handle *h,
460		      const enum nf_conntrack_query query,
461		      const void *data);
462
463extern int nfct_send(struct nfct_handle *h,
464		     const enum nf_conntrack_query query,
465		     const void *data);
466
467extern int nfct_catch(struct nfct_handle *h);
468
469/* copy */
470enum {
471	NFCT_CP_ALL = 0,
472	NFCT_CP_ORIG = (1 << 0),
473	NFCT_CP_REPL = (1 << 1),
474	NFCT_CP_META = (1 << 2),
475	NFCT_CP_OVERRIDE = (1 << 3),
476};
477
478extern void nfct_copy(struct nf_conntrack *dest,
479		      const struct nf_conntrack *source,
480		      unsigned int flags);
481
482extern void nfct_copy_attr(struct nf_conntrack *ct1,
483			   const struct nf_conntrack *ct2,
484			   const enum nf_conntrack_attr type);
485
486/* event filtering */
487
488struct nfct_filter;
489
490extern struct nfct_filter *nfct_filter_create(void);
491extern void nfct_filter_destroy(struct nfct_filter *filter);
492
493struct nfct_filter_proto {
494	uint16_t proto;
495	uint16_t state;
496};
497struct nfct_filter_ipv4 {
498	uint32_t addr;
499	uint32_t mask;
500};
501struct nfct_filter_ipv6 {
502	uint32_t addr[4];
503	uint32_t mask[4];
504};
505
506enum nfct_filter_attr {
507	NFCT_FILTER_L4PROTO = 0,	/* uint32_t */
508	NFCT_FILTER_L4PROTO_STATE,	/* struct nfct_filter_proto */
509	NFCT_FILTER_SRC_IPV4,		/* struct nfct_filter_ipv4 */
510	NFCT_FILTER_DST_IPV4,		/* struct nfct_filter_ipv4 */
511	NFCT_FILTER_SRC_IPV6,		/* struct nfct_filter_ipv6 */
512	NFCT_FILTER_DST_IPV6,		/* struct nfct_filter_ipv6 */
513	NFCT_FILTER_MARK,		/* struct nfct_filter_dump_mark */
514	NFCT_FILTER_MAX
515};
516
517extern void nfct_filter_add_attr(struct nfct_filter *filter,
518				 const enum nfct_filter_attr attr,
519				 const void *value);
520
521extern void nfct_filter_add_attr_u32(struct nfct_filter *filter,
522				     const enum nfct_filter_attr attr,
523				     const uint32_t value);
524
525enum nfct_filter_logic {
526	NFCT_FILTER_LOGIC_POSITIVE,
527	NFCT_FILTER_LOGIC_NEGATIVE,
528	NFCT_FILTER_LOGIC_MAX
529};
530
531extern int nfct_filter_set_logic(struct nfct_filter *filter,
532				 const enum nfct_filter_attr attr,
533				 const enum nfct_filter_logic logic);
534
535extern int nfct_filter_attach(int fd, struct nfct_filter *filter);
536extern int nfct_filter_detach(int fd);
537
538/* dump filtering */
539
540struct nfct_filter_dump;
541
542struct nfct_filter_dump_mark {
543	uint32_t val;
544	uint32_t mask;
545};
546
547enum nfct_filter_dump_attr {
548	NFCT_FILTER_DUMP_MARK = 0,	/* struct nfct_filter_dump_mark */
549	NFCT_FILTER_DUMP_L3NUM,		/* uint8_t */
550	NFCT_FILTER_DUMP_MAX
551};
552
553struct nfct_filter_dump *nfct_filter_dump_create(void);
554
555void nfct_filter_dump_destroy(struct nfct_filter_dump *filter);
556
557void nfct_filter_dump_set_attr(struct nfct_filter_dump *filter_dump,
558			       const enum nfct_filter_dump_attr type,
559			       const void *data);
560
561void nfct_filter_dump_set_attr_u8(struct nfct_filter_dump *filter_dump,
562				  const enum nfct_filter_dump_attr type,
563				  uint8_t data);
564
565/* low level API: netlink functions */
566
567extern __attribute__((deprecated)) int
568nfct_build_conntrack(struct nfnl_subsys_handle *ssh,
569				void *req,
570				size_t size,
571				uint16_t type,
572				uint16_t flags,
573				const struct nf_conntrack *ct);
574
575extern __attribute__((deprecated))
576int nfct_parse_conntrack(enum nf_conntrack_msg_type msg,
577				const struct nlmsghdr *nlh,
578				struct nf_conntrack *ct);
579
580extern __attribute__((deprecated))
581int nfct_build_query(struct nfnl_subsys_handle *ssh,
582			    const enum nf_conntrack_query query,
583			    const void *data,
584			    void *req,
585			    unsigned int size);
586
587/* New low level API: netlink functions */
588
589extern int nfct_nlmsg_build(struct nlmsghdr *nlh, const struct nf_conntrack *ct);
590extern int nfct_nlmsg_parse(const struct nlmsghdr *nlh, struct nf_conntrack *ct);
591extern int nfct_payload_parse(const void *payload, size_t payload_len, uint16_t l3num, struct nf_conntrack *ct);
592
593/*
594 * NEW expectation API
595 */
596
597/* expectation object */
598struct nf_expect;
599
600/* expect attributes */
601enum nf_expect_attr {
602	ATTR_EXP_MASTER = 0,	/* pointer to conntrack object */
603	ATTR_EXP_EXPECTED,	/* pointer to conntrack object */
604	ATTR_EXP_MASK,		/* pointer to conntrack object */
605	ATTR_EXP_TIMEOUT,	/* u32 bits */
606	ATTR_EXP_ZONE,		/* u16 bits */
607	ATTR_EXP_FLAGS,		/* u32 bits */
608	ATTR_EXP_HELPER_NAME,	/* string (16 bytes max) */
609	ATTR_EXP_CLASS,		/* u32 bits */
610	ATTR_EXP_NAT_TUPLE,	/* pointer to conntrack object */
611	ATTR_EXP_NAT_DIR,	/* u8 bits */
612	ATTR_EXP_FN,		/* string */
613	ATTR_EXP_MAX
614};
615
616/* constructor / destructor */
617extern struct nf_expect *nfexp_new(void);
618extern void nfexp_destroy(struct nf_expect *exp);
619
620/* clone */
621extern struct nf_expect *nfexp_clone(const struct nf_expect *exp);
622
623/* object size */
624extern size_t nfexp_sizeof(const struct nf_expect *exp);
625
626/* maximum object size */
627extern size_t nfexp_maxsize(void);
628
629/* register / unregister callback */
630
631extern int nfexp_callback_register(struct nfct_handle *h,
632				   enum nf_conntrack_msg_type type,
633				   int (*cb)(enum nf_conntrack_msg_type type,
634				  	     struct nf_expect *exp,
635					     void *data),
636				   void *data);
637
638extern void nfexp_callback_unregister(struct nfct_handle *h);
639
640/* register / unregister callback: extended version including netlink header */
641extern int nfexp_callback_register2(struct nfct_handle *h,
642				    enum nf_conntrack_msg_type type,
643				    int (*cb)(const struct nlmsghdr *nlh,
644				    	      enum nf_conntrack_msg_type type,
645					      struct nf_expect *exp,
646					      void *data),
647				    void *data);
648
649extern void nfexp_callback_unregister2(struct nfct_handle *h);
650
651/* setter */
652extern void nfexp_set_attr(struct nf_expect *exp,
653			   const enum nf_expect_attr type,
654			   const void *value);
655
656extern void nfexp_set_attr_u8(struct nf_expect *exp,
657			      const enum nf_expect_attr type,
658			      uint8_t value);
659
660extern void nfexp_set_attr_u16(struct nf_expect *exp,
661			       const enum nf_expect_attr type,
662			       uint16_t value);
663
664extern void nfexp_set_attr_u32(struct nf_expect *exp,
665			       const enum nf_expect_attr type,
666			       uint32_t value);
667
668/* getter */
669extern const void *nfexp_get_attr(const struct nf_expect *exp,
670				  const enum nf_expect_attr type);
671
672extern uint8_t nfexp_get_attr_u8(const struct nf_expect *exp,
673				  const enum nf_expect_attr type);
674
675extern uint16_t nfexp_get_attr_u16(const struct nf_expect *exp,
676				    const enum nf_expect_attr type);
677
678extern uint32_t nfexp_get_attr_u32(const struct nf_expect *exp,
679				    const enum nf_expect_attr type);
680
681/* checker */
682extern int nfexp_attr_is_set(const struct nf_expect *exp,
683			     const enum nf_expect_attr type);
684
685/* unsetter */
686extern int nfexp_attr_unset(struct nf_expect *exp,
687			    const enum nf_expect_attr type);
688
689/* query */
690extern int nfexp_query(struct nfct_handle *h,
691		       const enum nf_conntrack_query qt,
692		       const void *data);
693
694/* print */
695extern int nfexp_snprintf(char *buf,
696			  unsigned int size,
697			  const struct nf_expect *exp,
698			  const unsigned int msg_type,
699			  const unsigned int out_type,
700			  const unsigned int out_flags);
701
702/* compare */
703extern int nfexp_cmp(const struct nf_expect *exp1,
704		     const struct nf_expect *exp2,
705		     unsigned int flags);
706
707extern int nfexp_send(struct nfct_handle *h,
708		      const enum nf_conntrack_query qt,
709		      const void *data);
710
711extern int nfexp_catch(struct nfct_handle *h);
712
713/* low level API */
714extern __attribute__((deprecated))
715int nfexp_build_expect(struct nfnl_subsys_handle *ssh,
716			      void *req,
717			      size_t size,
718			      uint16_t type,
719			      uint16_t flags,
720			      const struct nf_expect *exp);
721
722extern __attribute__((deprecated))
723int nfexp_parse_expect(enum nf_conntrack_msg_type type,
724			      const struct nlmsghdr *nlh,
725			      struct nf_expect *exp);
726
727extern __attribute__((deprecated))
728int nfexp_build_query(struct nfnl_subsys_handle *ssh,
729			     const enum nf_conntrack_query qt,
730			     const void *data,
731			     void *buffer,
732			     unsigned int size);
733
734/* New low level API: netlink functions */
735
736extern int nfexp_nlmsg_build(struct nlmsghdr *nlh, const struct nf_expect *exp);
737extern int nfexp_nlmsg_parse(const struct nlmsghdr *nlh, struct nf_expect *exp);
738
739/* Bitset representing status of connection. Taken from ip_conntrack.h
740 *
741 * Note: For backward compatibility this shouldn't ever change
742 * 	 in kernel space.
743 */
744enum ip_conntrack_status {
745	/* It's an expected connection: bit 0 set.  This bit never changed */
746	IPS_EXPECTED_BIT = 0,
747	IPS_EXPECTED = (1 << IPS_EXPECTED_BIT),
748
749	/* We've seen packets both ways: bit 1 set.  Can be set, not unset. */
750	IPS_SEEN_REPLY_BIT = 1,
751	IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT),
752
753	/* Conntrack should never be early-expired. */
754	IPS_ASSURED_BIT = 2,
755	IPS_ASSURED = (1 << IPS_ASSURED_BIT),
756
757	/* Connection is confirmed: originating packet has left box */
758	IPS_CONFIRMED_BIT = 3,
759	IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT),
760
761	/* Connection needs src nat in orig dir.  This bit never changed. */
762	IPS_SRC_NAT_BIT = 4,
763	IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT),
764
765	/* Connection needs dst nat in orig dir.  This bit never changed. */
766	IPS_DST_NAT_BIT = 5,
767	IPS_DST_NAT = (1 << IPS_DST_NAT_BIT),
768
769	/* Both together. */
770	IPS_NAT_MASK = (IPS_DST_NAT | IPS_SRC_NAT),
771
772	/* Connection needs TCP sequence adjusted. */
773	IPS_SEQ_ADJUST_BIT = 6,
774	IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT),
775
776	/* NAT initialization bits. */
777	IPS_SRC_NAT_DONE_BIT = 7,
778	IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT),
779
780	IPS_DST_NAT_DONE_BIT = 8,
781	IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT),
782
783	/* Both together */
784	IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE),
785
786	/* Connection is dying (removed from lists), can not be unset. */
787	IPS_DYING_BIT = 9,
788	IPS_DYING = (1 << IPS_DYING_BIT),
789
790	/* Connection has fixed timeout. */
791	IPS_FIXED_TIMEOUT_BIT = 10,
792	IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
793
794	/* Conntrack is a template */
795	IPS_TEMPLATE_BIT = 11,
796	IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT),
797
798	/* Conntrack is a fake untracked entry */
799	IPS_UNTRACKED_BIT = 12,
800	IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT),
801};
802
803/* expectation flags */
804#define NF_CT_EXPECT_PERMANENT          0x1
805#define NF_CT_EXPECT_INACTIVE           0x2
806#define NF_CT_EXPECT_USERSPACE          0x4
807
808/*
809 * TCP flags
810 */
811
812/* Window scaling is advertised by the sender */
813#define IP_CT_TCP_FLAG_WINDOW_SCALE             0x01
814
815/* SACK is permitted by the sender */
816#define IP_CT_TCP_FLAG_SACK_PERM                0x02
817
818/* This sender sent FIN first */
819#define IP_CT_TCP_FLAG_CLOSE_INIT               0x04
820
821/* Be liberal in window checking */
822#define IP_CT_TCP_FLAG_BE_LIBERAL               0x08
823
824/* WARNING: do not use these constants in new applications, we keep them here
825 * to avoid breaking backward compatibility. */
826#define NFCT_DIR_ORIGINAL 0
827#define NFCT_DIR_REPLY 1
828#define NFCT_DIR_MAX NFCT_DIR_REPLY+1
829
830/* xt_helper uses a length size of 30 bytes, however, no helper name in
831 * the tree has exceeded 16 bytes length. Since 2.6.29, the maximum
832 * length accepted is 16 bytes, this limit is enforced during module load. */
833#define NFCT_HELPER_NAME_MAX	16
834
835#ifdef __cplusplus
836}
837#endif
838
839#endif	/* _LIBNETFILTER_CONNTRACK_H_ */
840